A virtual machine (VM) is an abstraction—a virtualization—of an actual physical computer system. The VM, also known as the “guest,” is installed on a host computer platform, which includes system hardware and one or more virtualization layers. Each VM is configured with its own operating system that runs on top of virtual system hardware as emulated by the virtualization layers. To the running operating system, the virtualization is generally transparent. That is, the guest operating system is not “aware” that it is not running directly on a physical CPU and accompanying hardware.
It is not uncommon for virtual datacenter solutions to use an in-guest component (also referred to herein as “in-guest agent”) to gather information about guest VMs or detect the occurrence of specific events in the VMs. Such information may be used to manage the VMs or monitor the performance or security of the VMs. For example, antivirus software which would otherwise run in a guest VM may be offloaded to a dedicated security VM (SVM), and the in-guest agent may leverage services provided by the guest VM's operation system (OS) to access information pertaining to files being accessed, processes running on the guest OS, etc. and provide such information to the antivirus software in the SVM. In turn, the antivirus software may perform a virus scan using the information provided by the in-guest agent.
Because the in-guest agent executes in the guest VM, the in-guest agent is vulnerable to tampering by other software entities inside that same VM. For example, malicious entities may attempt to alter the agent's code in memory or disable the agent to evade detection by antivirus software external to the VM that relies on the in-guest agent.
One approach to secure the in-guest agent is to install the agent as a kernel-level driver on the guest operating system (OS). Malicious entities without sufficient privilege may then lack direct access to resources used by in-guest agent. Nonetheless, malicious entities may gain access to such resources by, e.g., elevating their privilege levels, and thereafter tamper with the agent's code or disable the agent.